用变量的方式给SQL传值

        public static DataTable getSO_rsl(string p_key)
        {
            string sqlStr = string.Format(@"SELECT SO_NUMBER FROM(select ROWNUM RNO, SO_NUMBER FROM(SELECT DISTINCT SO_NUMBER
FROM TABLE_NAME WHERE SO_NUMBER IS NOT NULL");
            string sqlst = string.Format(@"))WHERE RNO<= 30 ORDER BY 1");
            StringBuilder where = new StringBuilder();
            where.Append(p_key.Equals("") ? "" : " AND SO_NUMBER LIKE '%'||:PKEY||'%'");
            DbParameter[] paras = new OracleParameter[1];
            paras[0] = new OracleParameter("PKEY", p_key);
            return DataAccessFactory.Instance.GetDataHelper().GetDataTable(sqlStr + where.ToString() + sqlst, paras);
        }